feat(@angular-devkit/build-angular): move browser-sync as optional dependency

[alan-agius4]

browser-sync is now an optional dependency of @angular-devkit/build-angular. This package is only needed when using the legacy @angular-devkit/build-angular:ssr-dev-server builder.

Closes #26349

[jase88]

Will this also be fixed on v16-lts?

[alan-agius4]

This is only available for version 17.1.x

[von-maurus]

Hi, is this fixed right now? I'm with this version:

 _                      _                 ____ _     ___
/ \   _ __   __ _ _   _| | __ _ _ __     / ___| |   |_ _|

/ △ \ | '_ \ / | | | | |/ _ | '__| | | | | | |
/ ___ | | | | (| | || | | (| | | | || | | |
// __| ||_, |_,||_,|| _|||
|___/

Angular CLI: 17.0.6
Node: 20.10.0
Package Manager: npm 10.2.3
OS: darwin arm64

Angular: 17.0.6
... animations, cli, common, compiler, compiler-cli, core, forms
... platform-browser, platform-browser-dynamic, router

Package Version

@angular-devkit/architect 0.1700.6
@angular-devkit/build-angular 17.0.6
@angular-devkit/core 17.0.6
@angular-devkit/schematics 17.0.6
@schematics/angular 17.0.6
rxjs 7.8.1
typescript 5.2.2
zone.js 0.14.2

And still tells me this error:

npm audit report

axios 0.8.1 - 1.5.1
Severity: moderate
Axios Cross-Site Request Forgery Vulnerability - GHSA-wf5p-g6vw-rhxx
fix available via npm audit fix --force
Will install @angular-devkit/build-angular@16.2.10, which is a breaking change
node_modules/localtunnel/node_modules/axios
localtunnel >=1.9.0
Depends on vulnerable versions of axios
node_modules/localtunnel
browser-sync >=2.24.0-rc1
Depends on vulnerable versions of localtunnel
node_modules/browser-sync
@angular-devkit/build-angular >=17.0.0-next.0
Depends on vulnerable versions of browser-sync
node_modules/@angular-devkit/build-angular

4 moderate severity vulnerabilities

[alfaproject]

@alan-agius4 any chance you can update to browser-sync v3 in the 17.0 branch, at least? It makes localtunnel optional

[dagerher]

@alan-agius4 Is it known if there is still much time left before the release of version 17.1.x?

[JeanMeche]

@dagerher Release is expected mid of next week !

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}